I have a Visualforce page and controller relying on the HTTP Referer header.


Before my org was upgraded to Spring '17 this returned e.g.:


Now it only returns the host without the url path:


Why is that so?


Please refer the Salesforce Spring ’17 Release Notes, this was implemented to enhance security of the platform.

Updated Referer Header

When loading assets outside of Salesforce, or navigating outside of Salesforce, the referer header shows only salesforce.com rather than the entire URL. This feature eliminates the potential for a referer header to reveal sensitive information that could be present in a full URL, such as an org ID. The updated referer header feature is supported only for Chrome and Firefox.

  • 2
    What is meant by "loading assets outside of Salesforce" and "navigating outside of Salesforce"? I an doing a redirect to a Salesforce Knowledge article inside of Salesforce. – Robert Sösemann Feb 7 '17 at 13:57
  • 1
    Hmm, seems like it should still work internally... – Adrian Larson Feb 7 '17 at 19:03
  • 1
    @AdrianLarson it does but not in pages that have an action tag. I solved my problem by not redirecting server-side using <apex:page action=""/> but using a JS client side redirect. – Robert Sösemann Feb 7 '17 at 20:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.